The Lightweight Directory Access Protocol (“LDAP”) is a standard computer networking protocol for querying and modifying entries in a database. The basic protocol is defined in a group of Internet Engineering Task Force (“IETF”) Request for Comments (“RFC”) documents; various aspects of the current version of the protocol (version 3) are described in RFCs listed in the “LDAP Technical Specification Road Map” (RFC4510, published June 2006). The databases reachable through LDAP may contain any sort of data, but most commonly contain identity, contact and authorization information for people and organizations.
LDAP presents a hierarchical view of the data in a database. Records are presented as a tree of entries, each entry identified uniquely within the hierarchy by its Distinguished Name (“DN”). Entries contain one or more attributes, which consist of an attribute description (an attribute type with zero or more options), plus one or more values of the attribute. For example, an attribute type might be “givenName”, and its value might be a text string that is the given name of a person described by the record.
Access to data in an IDAP database is provided by an IDAP server, which responds to commands from an IDAP client. For example, a client may create a new entry, delete an entry, rename an entry, modify an entry, or (most commonly) retrieve the attributes in an entry.
The IDAP standards specify certain properties that compliant servers (and their underlying databases) must have. These properties are known by the acronym ACID: Atomicity (updates must happen in an all-or-none fashion); Consistency (updates must begin at a consistent state and leave the updated database in a new consistent state); Isolation (no part of a multi-part update is visible to other clients until the complete update is performed); and Durability (successful updates will not be lost).
These properties are relatively easy to achieve in a single-server IDAP implementation, but a large network with many clients may generate enough IDAP operations to overwhelm a single server. Additional IDAP service capacity can be added with slave servers that respond to read-only (query) requests, while a master server handles all updates. However, some environments perform enough updates to overwhelm a single master server, and other environments (e.& geographically distributed networks) may operate more efficiently with a nearby master server. Unfortunately, it can be difficult for an LDAP service with multiple master servers to guarantee atomicity, consistency, isolation and durability of updates while maintaining the protocol's favorable speed characteristics. Operational techniques to coordinate multiple master servers may be of value.